{"id":"CVE-2026-14496","published":"2026-10-08T15:17:48.880","lastModified":"2026-10-14T23:58:46.747","description":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.","cvssScore":8.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cwes":["CWE-125"],"vendors":["ibm"],"products":["datapower gateway"],"references":[{"url":"https://www.ibm.com/support/pages/node/7289775","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A heap-based buffer overflow in IBM DataPower Gateway allows remote attackers to cause a denial of service by sending specially crafted input that exceeds allocated buffer boundaries, potentially leading to application crashes or unavailability.","exploitability":"Exploitation appears moderately difficult as it likely requires precise input crafting to trigger the heap overflow, though no public exploits are currently available and the vulnerability affects multiple versions without clear precondition requirements.","blast_radius":"The impact could be significant in environments where DataPower gateways serve as critical API or proxy services, potentially causing widespread service disruption across applications relying on these gateways.","remediation":"Upgrade to IBM DataPower Gateway 10.5.0.23, 10.6.7, 10.6.0.11, or 11.0.0.3 to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","gateway","ibm","heap-overflow"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:17:52.791Z"}}